I set my tcpwrappers like this, is it secure?
Do I need a firewall?

/etc/hosts.allow:

ALL: 127.

/etc/hosts.deny:

ALL: ALL

A firewall is usually not considered optional; you need it regardless of how you have your host configured. A firewall is a hedge-bet hoping that you have everything configured right, but just in case... Also, some times software (or OS) updates on your system will have unintended consequences and leave you open to things that you weren't open to before. That's what the firewall is for.

In theory, if you properly configure everything on your host and secure all your network applications, you wouldn't need a firewall (indead the SDSC does not use firewalls at all), but this assumes you're an elite security professional who never makes a mistake. You may be a professional, but you're still human, right? Mistakes are made every day...

Not every service runs through inetd/tcpwrappers (say - tcpd).
For example the X Server listens on port 6000/tcp by default, changes to your /etc/hosts.* files doesn't matter for this, as the X Server is not run with inetd/tcpd.
A Packetfilter is the safe bet.

You still need a firewall.

Now I'm sure, I really need a firewall, then I have some others questions.

First, I use Debian GNU/Linux, Kernel 2.2.xx, but I don't know if my kernel is configured to firewall (I looked at /proc/net, but there was nothing about ipfw_chains). Do I need to recompile/reinstall my kernel?
There are another way to do this?

Second, All examples of firewall that I saw, have one machine (firewall) between the internal network and the internet with two network cards. I use one machine with only one network card linked to the Internet. Do I need to use NAT or maskarade do make my firewall to work? If so, how to do it with my configuration?

Thank's a lot

If possible, you should upgrade to at least kernel 2.4.x because I believe the 2.2.x kernels only used ipchains. I don't remember enough about ipchains to help you with issues on that subject.

As for your second question, no. You do not need NAT if you only have one machine (MASQUERADE is just a special form of NAT so you don't need that either).

Are there an way of set firewalling with out need to recompile/reinstall the kernel, if it isn't configured to?
My kernel is 2.2.20 and I would like to try ipchains.
But if it is not possible to configure with out recompile/reinstall, I will use the latest kernel, of course.

I use Debian GNU/Linux, Kernel 2.2.xx, but I don't know if my kernel is configured to firewall (I looked at /proc/net, but there was nothing about ipfw_chains). Do I need to recompile/reinstall my kernel?
My kernel is 2.2.20 and I would like to try ipchains.
Check out the modules that came with the kernel.
If you haven't any *then* you need to recompile.
If you don't need the stateful filtering caps or other stuff, then Ipchains is a good start, at least you'll have a firewall...


Are there an way of set firewalling with out need to recompile/reinstall the kernel, if it isn't configured to?
What's called the "firewall" is actually part kernel framework, part user tools. It's not an add-on like some app. The kernel part takes care of the filtering, the userland tools, ipchains in 2.2.x and iptables in 2.4.x, are necessary because you have to "feed" the rules to the kernel. You don't want the kernel to read stuff itself and fsck up.